devil-linux-develop — developer discussions

[Devil-linux-develop] Any interest in adding Pound?

[Martin G. <sou...@gl...>]

Hey All,

Is there any interest in adding Pound ( http://www.apsis.ch/pound/) to DL?

I've already created the scripts and build for myself, just haven't moved i=
t=20
into a chroot yet.

I'm planning on using it as a front end for MS Exchange Outlook Web Access.

=46rom the website...

POUND - REVERSE-PROXY AND LOAD-BALANCER


 The Pound program is a reverse proxy, load balancer and HTTPS front-end fo=
r=20
Web server(s). Pound was developed to enable distributing the load among=20
several Web-servers and to allow for a convenient SSL wrapper for those Web=
=20
servers that do not offer it natively. Pound is distributed under the GPL -=
=20
no warranty, it's free to use, copy and give away.


WHAT POUND IS:

 a reverse-proxy: it passes requests from client browsers to one or more=20
back-end servers.
 a load balancer: it will distribute the requests from the client browsers=
=20
among several back-end servers, while keeping session information.
 an SSL wrapper: Pound will decrypt HTTPS requests from client browsers and=
=20
pass them as plain HTTP to the back-end servers.
 an HTTP/HTTPS sanitizer: Pound will verify requests for correctness and=20
accept only well-formed ones.
 a fail over-server: should a back-end server fail, Pound will take note of=
=20
the fact and stop passing requests to it until it recovers.
 a request redirector: requests may be distributed among servers according =
to=20
the requested URL.

Pound is a very small program, easily audited for security problems. It can=
=20
run as setuid/setgid and/or in a chroot jail. Pound does not access the=20
hard-disk at all (except for reading the certificate file on start, if=20
required) and should thus pose no security threat to any machine.

Martin

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Heiko Z. <he...@zu...>]

Kim Thye Chua wrote:

>
> I found that Python works fine with devil-linux version 
> 1.2.5-i686-SMP-server. But I'm trying to rebuild the distro to upgrade 
> Python to v2.4.1, could you provide me with the .config (menuconfig) 
> file for 1.2.5 -server version ?
>

Take the default config and just de-select grsecurity.

-- 

Regards
  Heiko
  http://www.devil-linux.org

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Kim T. C. <th...@ah...>]

I found that Python works fine with devil-linux version 
1.2.5-i686-SMP-server. But I'm trying to rebuild the distro to upgrade 
Python to v2.4.1, could you provide me with the .config (menuconfig) 
file for 1.2.5 -server version ?


/kim

Bruce Smith wrote:

>>http://www.grsecurity.net/features.php
>>I don't care about the RBAC stuff, but the other things are important to 
>>me. For example a 'normal' chroot without grsec is not really secure, 
>>since it's easy to break out of it.
>>    
>>
>
>Some of the features would be nice, but others bite us in the ass.
>
>Is there a compile option to skip the RBAC stuff,and anything else that
>is causing us problems?  Or some way to specify it in the grsec conf?
>
> - BS
>
>
>
>
>-------------------------------------------------------
>SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
>from IBM. Find simple to follow Roadmaps, straightforward articles,
>informative Webcasts and more! Get everything you need to get up to
>speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
>_______________________________________________
>Devil-linux-develop mailing list
>Dev...@li...
>https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
>
>  
>

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Heiko Z. <he...@zu...>]

Bruce Smith wrote:

>>http://www.grsecurity.net/features.php
>>I don't care about the RBAC stuff, but the other things are important to 
>>me. For example a 'normal' chroot without grsec is not really secure, 
>>since it's easy to break out of it.
>>    
>>
>
>Some of the features would be nice, but others bite us in the ass.
>
>Is there a compile option to skip the RBAC stuff,and anything else that
>is causing us problems?  Or some way to specify it in the grsec conf?
>
>  
>

No.
There are different options you can choose, but many different of them 
could cause issues.

-- 

Regards
  Heiko
  http://www.devil-linux.org

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Bruce S. <bw...@ar...>]

> http://www.grsecurity.net/features.php
> I don't care about the RBAC stuff, but the other things are important to 
> me. For example a 'normal' chroot without grsec is not really secure, 
> since it's easy to break out of it.

Some of the features would be nice, but others bite us in the ass.

Is there a compile option to skip the RBAC stuff,and anything else that
is causing us problems?  Or some way to specify it in the grsec conf?

 - BS

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Heiko Z. <he...@zu...>]

Bruce Smith wrote:

>>>Did I ever mention how much I dislike grescurity?   :-)
>>>
>>>      
>>>
>>Every day. ;-)
>>But for me it's a necessary evil, because it also adds a lot of benefits.
>>    
>>
>
>Such as?
>  
>
http://www.grsecurity.net/features.php
I don't care about the RBAC stuff, but the other things are important to 
me. For example a 'normal' chroot without grsec is not really secure, 
since it's easy to break out of it.

-- 

Regards
  Heiko
  http://www.devil-linux.org

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Bruce S. <bw...@ar...>]

> >Did I ever mention how much I dislike grescurity?   :-)
> >
> Every day. ;-)
> But for me it's a necessary evil, because it also adds a lot of benefits.

Such as?

 - BS

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Heiko Z. <he...@zu...>]

Bruce Smith wrote:

>>>Jun 15 10:32:23 src@Devil kernel: grsec: From 192.168.0.16: signal 11 
>>>sent to /usr/bin/python2.4[python:26501] uid/euid:0/0 gid/egid:0/0, 
>>>parent /bin/bash[bash:26419] uid/euid:0/0 gid/egid:0/0
>>>Jun 15 10:32:23 src@Devil kernel: grsec: From 192.168.0.16: denied 
>>>resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 
>>>for /usr/bin/python2.4[python:26501] uid/euid:0/0 gid/egid:0/0, parent 
>>>/bin/bash[bash:26419] uid/euid:0/0 gid/egid:0/0
>>>
>>>
>>>where I have the other window doing:
>>>
>>>root@Devil:/tmp # cat s.py
>>>import smtplib
>>>
>>>server = smtplib.SMTP('localhost')
>>>server.quit()
>>>root@Devil:/tmp # python s.py
>>>Segmentation fault
>>>
>>>      
>>>
>>I think your best chance right now is asking the questions on the 
>>grsecurity forum, I really can't help you much there.
>>    
>>
>
>It definitely appears to be a grsecurity related issue.  
>The easy solution is to use the i686-server release of DL (no grsec!).
>
>Did I ever mention how much I dislike grescurity?   :-)
>
>
>  
>
Every day. ;-)
But for me it's a necessary evil, because it also adds a lot of benefits.


-- 

Regards
  Heiko
  http://www.devil-linux.org

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Bruce S. <bw...@ar...>]

> > Jun 15 10:32:23 src@Devil kernel: grsec: From 192.168.0.16: signal 11 
> > sent to /usr/bin/python2.4[python:26501] uid/euid:0/0 gid/egid:0/0, 
> > parent /bin/bash[bash:26419] uid/euid:0/0 gid/egid:0/0
> > Jun 15 10:32:23 src@Devil kernel: grsec: From 192.168.0.16: denied 
> > resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 
> > for /usr/bin/python2.4[python:26501] uid/euid:0/0 gid/egid:0/0, parent 
> > /bin/bash[bash:26419] uid/euid:0/0 gid/egid:0/0
> >
> >
> > where I have the other window doing:
> >
> > root@Devil:/tmp # cat s.py
> > import smtplib
> >
> > server = smtplib.SMTP('localhost')
> > server.quit()
> > root@Devil:/tmp # python s.py
> > Segmentation fault
> >
> 
> I think your best chance right now is asking the questions on the 
> grsecurity forum, I really can't help you much there.

It definitely appears to be a grsecurity related issue.  
The easy solution is to use the i686-server release of DL (no grsec!).

Did I ever mention how much I dislike grescurity?   :-)

 - BS

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Heiko Z. <he...@zu...>]

Kim Thye Chua wrote:

> Thanks Heiko,
>
> >Is this producing the same log output?
>
> Sorry, the exact log output is this:
>
> Jun 15 10:32:23 src@Devil kernel: grsec: From 192.168.0.16: signal 11 
> sent to /usr/bin/python2.4[python:26501] uid/euid:0/0 gid/egid:0/0, 
> parent /bin/bash[bash:26419] uid/euid:0/0 gid/egid:0/0
> Jun 15 10:32:23 src@Devil kernel: grsec: From 192.168.0.16: denied 
> resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 
> for /usr/bin/python2.4[python:26501] uid/euid:0/0 gid/egid:0/0, parent 
> /bin/bash[bash:26419] uid/euid:0/0 gid/egid:0/0
>
>
> where I have the other window doing:
>
> root@Devil:/tmp # cat s.py
> import smtplib
>
> server = smtplib.SMTP('localhost')
> server.quit()
> root@Devil:/tmp # python s.py
> Segmentation fault
>

I think your best chance right now is asking the questions on the 
grsecurity forum, I really can't help you much there.

-- 

Regards
  Heiko
  http://www.devil-linux.org

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Kim T. C. <th...@ah...>]

Thanks Heiko,

 >Is this producing the same log output?

Sorry, the exact log output is this:

Jun 15 10:32:23 src@Devil kernel: grsec: From 192.168.0.16: signal 11 
sent to /usr/bin/python2.4[python:26501] uid/euid:0/0 gid/egid:0/0, 
parent /bin/bash[bash:26419] uid/euid:0/0 gid/egid:0/0
Jun 15 10:32:23 src@Devil kernel: grsec: From 192.168.0.16: denied 
resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for 
/usr/bin/python2.4[python:26501] uid/euid:0/0 gid/egid:0/0, parent 
/bin/bash[bash:26419] uid/euid:0/0 gid/egid:0/0


where I have the other window doing:

root@Devil:/tmp # cat s.py
import smtplib

server = smtplib.SMTP('localhost')
server.quit()
root@Devil:/tmp # python s.py
Segmentation fault

/kim



Heiko Zuerker wrote:

> Kim Thye Chua wrote:
>
>> Hi all,
>>
>> I've written some Python scripts on my Devil Linux 1.2.5 system but I 
>> got some strange segmentation fault error. Looks like 'grsecurity' 
>> patch doesn't live happily with Python, in /var/log/message you can see:
>>
>> Jun 15 00:07:01 src@Devil kernel: grsec: From 192.168.0.5: signal 11 
>> sent to /usr/bin/python2.4[python:19084] uid/euid:0/0 gid/egid:0/0, 
>> parent /usr/sbin/cron[cron:19083] uid/euid:0/0 gid/egid:0/0
>> Jun 15 00:07:01 src@Devil kernel: grsec: From 192.168.0.5: denied 
>> resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 
>> for /usr/bin/python2.4[python:19084] uid/euid:0/0 gid/egid:0/0, 
>> parent /usr/sbin/cron[cron:19083] uid/euid:0/0 gid/egid:0/0
>
>
> The second line just means that python tried to create a core dump, 
> but wasn't allowed to.
> So the main question is why it received a signal 11.
>
>>
>> The easiest way to reproduce it by a 2-lines Python script:
>>
>> root@Devil:/tmp # cat s.py
>> import smtplib
>>
>> server = smtplib.SMTP('localhost')
>>
>> root@Devil:/tmp # python s.py
>> Segmentation fault
>> root@Devil:/tmp #
>>
> Is this producing the same log output?
>
>> Any Python develper here that come across the same issue ?
>
>
> You may want to try the grsecurity forum ( http://www.grsecurity.net ).
>
>> or is there a way to disable grsecurity ?
>>
> No, BUT:
> There is a "-server" version of DL, which has no grsecurity included.
>

Re: [Devil-linux-develop] Python not compatible with grsecurity

[Heiko Z. <he...@zu...>]

Kim Thye Chua wrote:

> Hi all,
>
> I've written some Python scripts on my Devil Linux 1.2.5 system but I 
> got some strange segmentation fault error. Looks like 'grsecurity' 
> patch doesn't live happily with Python, in /var/log/message you can see:
>
> Jun 15 00:07:01 src@Devil kernel: grsec: From 192.168.0.5: signal 11 
> sent to /usr/bin/python2.4[python:19084] uid/euid:0/0 gid/egid:0/0, 
> parent /usr/sbin/cron[cron:19083] uid/euid:0/0 gid/egid:0/0
> Jun 15 00:07:01 src@Devil kernel: grsec: From 192.168.0.5: denied 
> resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 
> for /usr/bin/python2.4[python:19084] uid/euid:0/0 gid/egid:0/0, parent 
> /usr/sbin/cron[cron:19083] uid/euid:0/0 gid/egid:0/0

The second line just means that python tried to create a core dump, but 
wasn't allowed to.
So the main question is why it received a signal 11.

>
> The easiest way to reproduce it by a 2-lines Python script:
>
> root@Devil:/tmp # cat s.py
> import smtplib
>
> server = smtplib.SMTP('localhost')
>
> root@Devil:/tmp # python s.py
> Segmentation fault
> root@Devil:/tmp #
>
Is this producing the same log output?

> Any Python develper here that come across the same issue ?

You may want to try the grsecurity forum ( http://www.grsecurity.net ).

> or is there a way to disable grsecurity ?
>
No, BUT:
There is a "-server" version of DL, which has no grsecurity included.

-- 

Regards
  Heiko
  http://www.devil-linux.org

[Devil-linux-develop] Python not compatible with grsecurity

[Kim T. C. <th...@ah...>]

Hi all,

I've written some Python scripts on my Devil Linux 1.2.5 system but I 
got some strange segmentation fault error. Looks like 'grsecurity' patch 
doesn't live happily with Python, in /var/log/message you can see:

Jun 15 00:07:01 src@Devil kernel: grsec: From 192.168.0.5: signal 11 
sent to /usr/bin/python2.4[python:19084] uid/euid:0/0 gid/egid:0/0, 
parent /usr/sbin/cron[cron:19083] uid/euid:0/0 gid/egid:0/0
Jun 15 00:07:01 src@Devil kernel: grsec: From 192.168.0.5: denied 
resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for 
/usr/bin/python2.4[python:19084] uid/euid:0/0 gid/egid:0/0, parent 
/usr/sbin/cron[cron:19083] uid/euid:0/0 gid/egid:0/0

The easiest way to reproduce it by a 2-lines Python script:

root@Devil:/tmp # cat s.py
import smtplib

server = smtplib.SMTP('localhost')

root@Devil:/tmp # python s.py
Segmentation fault
root@Devil:/tmp #

Any Python develper here that come across the same issue ?
or is there a way to disable grsecurity ?

/Kim

Re: [Devil-linux-develop] small patches/USB stick installation notes

[Heiko Z. <he...@zu...>]

Hi,

thanks for the infos.
It would actually help us a lot, if you could attach patches to fix the
mentioned problems.

Heiko

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> I hope this isn't too off-topic for the list - I poked around the site
> for a while and this seemed to be the most appropriate address to send
> this information to.
>
> I recently pulled down the 1.2.5 release of Devil-Linux and was able to
> get it running on an Openbrick-E
> (http://shopping.hacom.net/catalog/product_info.php?cPath=22_45&products_
> id=30) with a 256MB USB stick in no time at all.
>
> A couple of observations:
>
>
> * install-on-usb didn't work for me as shipped.  The problem is that cp
> -p
> exits with return code 1 when copying the source iso over to the USB stick
>  (because of the filesystem type on the USB stick).  It looks like this:
>
>
> Last chance, do you really want to continue ?  (y/n) y
> Installing syslinux MBR
> 0+1 records in
> 0+1 records out
> 304 bytes transferred in 0.006160 seconds (49350 bytes/sec)
> installing SysLinux boot sector copying files copying source file
bootcd.iso
> to device mounted on ./tmp-install2usb/disk-mnt/bootcd.iso
> cp: failed to preserve ownership for
> `./tmp-install2usb/disk-mnt/bootcd.iso': Operation not permitted
>
>
> (and then the script exits)
>
>
> The fix is trivial - either drop the -p or remove the "|| return 1" from
> line 43 of the script.
>
> * I tried using a single partition and ran into problems with save-config
>  because the script kept trying to mount the already mounted partion
> under /var/adm/mount.  This could be done with a bind mount, or much
> simpler, it seems that save-config could check for /config/etc.tar.bz2 in
> the root filesystem if there are no other mountable partitions containing
> configurations.
>
> * When using 2 paritions on a single USB stick, the message "syncing and
> unmounting (this could take a while)" comes *after* the filesystem has
> been synced because sync gets called on line 393 after copying the
> etc.tar.bz2 to the second parition.  This is purely aesthetic, but it
> caught my eye because when I was trying with a single parition, the
> message came before the sync. It's a useful message, given how long it
> takes to sync the ISO to the USB stick, so it might be good to either
> duplicate it before invoking sync on line 393, or skipping that sync since
> it's going to occur right after dl_install() completes.
>
> Great distro!
>
>
> Thanks,
> tony -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
>
> iD8DBQFCrRttpdwBkPlyvgMRAlWPAKCDOqVhUqct3Pw2iuviAJpnwF/C+gCfVSPD
> CdoSXZgJDF6dKhnhQvzAdH0=
> =MSIi
> -----END PGP SIGNATURE-----
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you
> shotput a projector? How fast can you ride your desk chair down the office
> luge track? If you want to score the big prize, get to know the little
> guy. Play to win an NEC 61" plasma display: http://www.necitguy.com/?r=20
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop
>
>
>


-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

[Devil-linux-develop] small patches/USB stick installation notes

[tony m. <to...@ma...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I hope this isn't too off-topic for the list - I poked around the site for a
while and this seemed to be the most appropriate address to send this
information to.

I recently pulled down the 1.2.5 release of Devil-Linux and was able to get
it running on an Openbrick-E
(http://shopping.hacom.net/catalog/product_info.php?cPath=22_45&products_id=30)
with a 256MB USB stick in no time at all.

A couple of observations:

* install-on-usb didn't work for me as shipped.  The problem is that cp -p
exits with return code 1 when copying the source iso over to the USB stick
(because of the filesystem type on the USB stick).  It looks like this:

Last chance, do you really want to continue ?  (y/n) y
Installing syslinux MBR
0+1 records in
0+1 records out
304 bytes transferred in 0.006160 seconds (49350 bytes/sec)
installing SysLinux boot sector
copying files
copying source file bootcd.iso to device mounted on
./tmp-install2usb/disk-mnt/bootcd.iso
cp: failed to preserve ownership for
`./tmp-install2usb/disk-mnt/bootcd.iso': Operation not permitted

(and then the script exits)

The fix is trivial - either drop the -p or remove the "|| return 1" from
line 43 of the script.

* I tried using a single partition and ran into problems with save-config
because the script kept trying to mount the already mounted partion under
/var/adm/mount.  This could be done with a bind mount, or much simpler, it
seems that save-config could check for /config/etc.tar.bz2 in the root
filesystem if there are no other mountable partitions containing configurations.

* When using 2 paritions on a single USB stick, the message "syncing and
unmounting (this could take a while)" comes *after* the filesystem has been
synced because sync gets called on line 393 after copying the etc.tar.bz2 to
the second parition.  This is purely aesthetic, but it caught my eye because
when I was trying with a single parition, the message came before the sync.
 It's a useful message, given how long it takes to sync the ISO to the USB
stick, so it might be good to either duplicate it before invoking sync on
line 393, or skipping that sync since it's going to occur right after
dl_install() completes.

Great distro!

Thanks,
tony
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCrRttpdwBkPlyvgMRAlWPAKCDOqVhUqct3Pw2iuviAJpnwF/C+gCfVSPD
CdoSXZgJDF6dKhnhQvzAdH0=
=MSIi
-----END PGP SIGNATURE-----

Re: [Devil-linux-develop] [PATCH] Add support for Outlook clients - cyrus-sasl

[Heiko Z. <he...@zu...>]

> Hi,
>
>
> A minor patch to add login support to cyrus-sasl which allows Outlook
> clients to authenticate against a Postfix server.
>

DONE

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

Re: [Devil-linux-develop] btmp broken.

[Bruce S. <bw...@ar...>]

> > /var/log/btmp is broken because of bad permissions.
> > (is 644, s/b 600)
> >
> > Is this a bug or a feature (so /var doesn't fill up)?
> > i.e.  Should I fix it?   :-)
> 
> And I thought it's a local problem in my system... ;-)
> 
> Yes please fix it.

Done.

Keep in mind this could be used as a DoS against DL since /var can be in
memory and logrotate doesn't run by default.

> Check logrotate.conf, I found a line in there too. 

> Don't even know why we should need it in there....

To keep memory from filling up?  :-)

 - BS

Re: [Devil-linux-develop] btmp broken.

[Heiko Z. <he...@zu...>]

> /var/log/btmp is broken because of bad permissions.
> (is 644, s/b 600)
>
>
> Is this a bug or a feature (so /var doesn't fill up)?
> i.e.  Should I fix it?   :-)

And I thought it's a local problem in my system... ;-)

Yes please fix it.
Check logrotate.conf, I found a line in there too. Don't even know why we
should need it in there....

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

[Devil-linux-develop] btmp broken.

[Bruce S. <bw...@ar...>]

/var/log/btmp is broken because of bad permissions.
(is 644, s/b 600)

Is this a bug or a feature (so /var doesn't fill up)?
i.e.  Should I fix it?   :-)

 - BS

Re: [Devil-linux-develop] webmin

[Heiko Z. <he...@zu...>]

Hey,

> just wondering about webmin in dl. I guess it is not present, how hard
> could be add it?
>
> In which dl release may be right do it?
>
>
> Is anyone interested in this?

A few people asked before about it, I guess once it's in there many more
will use it.

There's a patch in the CVS repository which I created once for an older
Webmin version, it was actually quite easy.
The main work is to get everything adjusted to DL and since it's all Perl
I had to give up on it.

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

[Devil-linux-develop] webmin

[Andrea F. <af...@fa...>]

Hi to all,

just wondering about webmin in dl. I guess it is not present, how hard 
could be add it?

In which dl release may be right do it?

Is anyone interested in this?

Regards,
Andrea

[Devil-linux-develop] New package request; vpnd

[Peter O. <pet...@vi...>]

I was thinking - would it be possible to include the package called vpnd
in the standard devil-linux distribution? I know that OpenVPN is
included - However, vpnd is a really simple way of setting up a VPN
tunnel, OpenVPN probably have higer security - but I think vpnd could be
an alternative sometimes, especially when you want to keep it simple...
=20
http://sunsite.dk/vpnd/
=20
Best regards,
Peter Olsson
Visionutveckling AB
=20

[Devil-linux-develop] Patch acceptance policy...

[Peter O. <pet...@vi...>]

Hello,
=20
Jay Vosburgh has made a patch for the bonding driver in the 2.6.x
kernel, this patch adds better vlan support for self generated ARP
packets. I have ported and tested this patch in 2.4.31-rc1, and it works
great. Hopefully the patch will be apart of the kernel mainline in a
near future, but it's not there yet. I was thinking, will you accept
patches like this, and apply them in the next release of DL, or what's
your policy for patching?
=20
I'm attaching the patch to this mail, you're free to use it if you like,
it is made against 2.4.31-rc1, I'm not sure if it works against 2.4.30,
but it should, maybe except the first part that adds information to the
changelog in the top of bond_main.c.
=20
----
=20
diff -Naur -p linux-2.4.31-rc1/drivers/net/bonding/bond_main.c
linux-2.4.31-rc1-patched/drivers/net/bonding/bond_main.c
--- linux-2.4.31-rc1/drivers/net/bonding/bond_main.c	2005-05-26
16:17:31.000000000 +0200
+++ linux-2.4.31-rc1-patched/drivers/net/bonding/bond_main.c
2005-05-26 16:20:34.000000000 +0200
@@ -469,6 +469,7 @@
  *	  * Add support for VLAN hardware acceleration capable slaves.
  *	  * Add capability to tag self generated packets in ALB/TLB
modes.
  *	  Set version to 2.6.0.
+ *
  * 2004/10/29 - Mitch Williams <mitch.a.williams at intel dot com>
  *	- Fixed bug when unloading module while using 802.3ad.  If
  *	  spinlock debugging is turned on, this causes a stack dump.
@@ -476,6 +477,13 @@
  *	  spinlock.
  *	  Set version to 2.6.1.
  *
+ * 2005/05/26 - Peter Olsson <peter at visionutv dot se>
+ *	- Enhance VLAN support:
+ *	  * Implement gratuitous ARP patch in 2.4.x kernel (better VLAN
support)
+ *	    Originally written by Jay Vosburgh <fubar at us dot ibm dot
com>
+ *	- Implement patch written by David S. Miller <davem at davemloft
dot net>
+ *	  * Fix "bonding using arp_ip_target may stay down with active
path"
+ *	  Set version to 2.6.2.
  */
=20
 //#define BONDING_DEBUG 1
@@ -519,6 +527,7 @@
 #include <linux/ethtool.h>
 #include <linux/if_vlan.h>
 #include <linux/if_bonding.h>
+#include <net/route.h>
 #include "bonding.h"
 #include "bond_3ad.h"
 #include "bond_alb.h"
@@ -574,7 +583,6 @@ static struct proc_dir_entry *bond_proc_
=20
 static u32 arp_target[BOND_MAX_ARP_TARGETS] =3D { 0, } ;
 static int arp_ip_count	=3D 0;
-static u32 my_ip	=3D 0;
 static int bond_mode	=3D BOND_MODE_ROUNDROBIN;
 static int lacp_fast	=3D 0;
 static int app_abi_ver	=3D 0;
@@ -611,6 +619,7 @@ static struct bond_parm_tbl bond_mode_tb
 /*-------------------------- Forward declarations
---------------------------*/
=20
 static inline void bond_set_mode_ops(struct net_device *bond_dev, int
mode);
+static void bond_send_gratuitous_arp(struct bonding *bond);
=20
 /*---------------------------- General routines
-----------------------------*/
=20
@@ -659,6 +668,7 @@ static int bond_add_vlan(struct bonding=20
=20
 	INIT_LIST_HEAD(&vlan->vlan_list);
 	vlan->vlan_id =3D vlan_id;
+	vlan->vlan_ip =3D 0;
=20
 	write_lock_bh(&bond->lock);
=20
@@ -1477,16 +1487,6 @@ static void bond_change_active_slave(str
 		}
 	}
=20
-	if (bond->params.mode =3D=3D BOND_MODE_ACTIVEBACKUP) {
-		if (old_active) {
-			bond_set_slave_inactive_flags(old_active);
-		}
-
-		if (new_active) {
-			bond_set_slave_active_flags(new_active);
-		}
-	}
-
 	if (USES_PRIMARY(bond->params.mode)) {
 		bond_mc_swap(bond, new_active, old_active);
 	}
@@ -1497,6 +1497,17 @@ static void bond_change_active_slave(str
 	} else {
 		bond->curr_active_slave =3D new_active;
 	}
+
+	if (bond->params.mode =3D=3D BOND_MODE_ACTIVEBACKUP) {
+		if (old_active) {
+			bond_set_slave_inactive_flags(old_active);
+		}
+
+		if (new_active) {
+			bond_set_slave_active_flags(new_active);
+		}
+		bond_send_gratuitous_arp(bond);
+	}
 }
=20
 /**
@@ -2703,15 +2714,177 @@ out:
 	read_unlock(&bond->lock);
 }
=20
+
+static u32 bond_glean_dev_ip(struct net_device *dev)
+{
+	struct in_device *in_dev;
+	struct in_ifaddr *ifa;
+	u32 addr =3D 0;
+
+	if (!dev)
+		return 0;
+
+	in_dev =3D in_dev_get(dev);
+	if (!in_dev)
+		return 0;
+	=09
+	read_lock(&in_dev->lock);
+	=09
+	ifa =3D in_dev->ifa_list;
+	if (!ifa) {
+		goto out;
+	}
+
+	addr =3D ifa->ifa_local;
+out:
+	read_unlock(&in_dev->lock);
+	in_dev_put(in_dev);
+	return addr;
+}
+
+static int bond_has_ip(struct bonding *bond)
+{
+	struct vlan_entry *vlan, *vlan_next;
+
+	if (bond->master_ip)
+		return 1;
+
+	if (list_empty(&bond->vlan_list))
+		return 0;
+
+	list_for_each_entry_safe(vlan, vlan_next, &bond->vlan_list,
+				 vlan_list) {
+		if (vlan->vlan_ip)
+			return 1;
+	}
+
+	return 0;
+}
+
+/*
+ * We go to the (large) trouble of VLAN tagging ARP frames because
+ * switches in VLAN mode (especially if ports are configured as
+ * "native" to a VLAN) might not pass non-tagged frames.
+ */
+static void bond_arp_send(struct net_device *slave_dev, int arp_op, u32
dest_ip, u32 src_ip, unsigned short vlan_id)
+{
+	struct sk_buff *skb;
+
+	dprintk("arp %d on slave %s: dst %x src %x vid %d\n", arp_op,
+	       slave_dev->name, dest_ip, src_ip, vlan_id);
+	      =20
+	skb =3D arp_create(arp_op, ETH_P_ARP, dest_ip, slave_dev, src_ip,
+			 NULL, slave_dev->dev_addr, NULL);
+
+	if (!skb) {
+		printk(KERN_ERR DRV_NAME ": ARP packet allocation
failed\n");
+		return;
+	}
+	if (vlan_id) {
+		skb =3D vlan_put_tag(skb, vlan_id);
+		if (!skb) {
+			printk(KERN_ERR DRV_NAME ": failed to insert
VLAN tag\n");
+			return;
+		}
+	}
+	arp_xmit(skb);
+}
+
+
 static void bond_arp_send_all(struct bonding *bond, struct slave
*slave)
 {
-	int i;
+	int i, vlan_id, rv;
 	u32 *targets =3D bond->params.arp_targets;
+	struct vlan_entry *vlan, *vlan_next;
+	struct net_device *vlan_dev;
+	struct rt_key fl;
+	struct rtable *rt;
=20
 	for (i =3D 0; (i < BOND_MAX_ARP_TARGETS) && targets[i]; i++) {
-		arp_send(ARPOP_REQUEST, ETH_P_ARP, targets[i],
slave->dev,
-			 my_ip, NULL, slave->dev->dev_addr,
-			 NULL);
+		dprintk("basa: target %x\n", targets[i]);
+		if (list_empty(&bond->vlan_list)) {
+			dprintk("basa: empty vlan: arp_send\n");
+			bond_arp_send(slave->dev, ARPOP_REQUEST,
targets[i],
+				      bond->master_ip, 0);
+			continue;
+		}
+
+		memset(&fl, 0, sizeof(fl));
+		fl.dst =3D targets[i];
+		fl.tos =3D RTO_ONLINK;
+
+		rv =3D ip_route_output_key(&rt, &fl);
+		if (rv) {
+			if (net_ratelimit())
+				printk("basa: no route to %x\n",
fl.dst);
+			continue;
+		}
+
+		/*
+		 * We have VLANs configured, but this target is not on
+		 * a VLAN
+		 */
+		if (rt->u.dst.dev =3D=3D bond->dev) {
+			dprintk("basa: rtdev =3D=3D bond->dev: arp_send\n");
+			bond_arp_send(slave->dev, ARPOP_REQUEST,
targets[i],
+				      bond->master_ip, 0);
+			continue;
+		}
+
+		/*
+		 * See if this is one of our VLAN devices
+		 */
+		vlan_id =3D 0;
+		list_for_each_entry_safe(vlan, vlan_next,
&bond->vlan_list,
+					 vlan_list) {
+			vlan_dev =3D
bond->vlgrp->vlan_devices[vlan->vlan_id];
+			if (vlan_dev =3D=3D rt->u.dst.dev) {
+				vlan_id =3D vlan->vlan_id;
+				dprintk("basa: vlan match on %s %d\n",
+				       vlan_dev->name, vlan_id);
+				break;
+			}
+		}
+
+		if (vlan_id) {
+			bond_arp_send(slave->dev, ARPOP_REQUEST,
targets[i],
+				      vlan->vlan_ip, vlan_id);
+			continue;
+		}
+
+		if (net_ratelimit())
+			printk("basa: no route via bond to ip %x rt.dev
%s\n",
+			       targets[i],
+			       rt->u.dst.dev ? rt->u.dst.dev->name :
"NULL");
+	}
+}
+
+/*
+ * Kick out a gratuitous ARP for an IP on bond0 plus one for each VLAN
+ * above us.
+ */
+static void bond_send_gratuitous_arp(struct bonding *bond)
+{
+	struct slave *slave =3D bond->curr_active_slave;
+	struct vlan_entry *vlan;
+	struct net_device *vlan_dev;
+
+	dprintk("bond_send_grat_arp: bond %s slave %s\n",
bond->dev->name,
+				slave ? slave->dev->name : "NULL");
+	if (!slave)
+		return;
+
+	if (bond->master_ip) {
+		bond_arp_send(slave->dev, ARPOP_REPLY, bond->master_ip,
+				  bond->master_ip, 0);
+	}
+
+	list_for_each_entry(vlan, &bond->vlan_list, vlan_list) {
+		vlan_dev =3D bond->vlgrp->vlan_devices[vlan->vlan_id];
+		if (vlan->vlan_ip) {
+			bond_arp_send(slave->dev, ARPOP_REPLY,
vlan->vlan_ip,
+				      vlan->vlan_ip, vlan->vlan_id);
+		}
 	}
 }
=20
@@ -2789,8 +2962,8 @@ static void bond_loadbalance_arp_mon(str
 			 * if we don't know our ip yet
 			 */
 			if (((jiffies - slave->dev->trans_start) >=3D
(2*delta_in_ticks)) ||
-			    (((jiffies - slave->dev->last_rx) >=3D
(2*delta_in_ticks)) &&
-			     my_ip)) {
+			    (((jiffies - slave->dev->last_rx) >=3D
(2*delta_in_ticks))=20
+			     && bond_has_ip(bond))) {
=20
 				slave->link  =3D BOND_LINK_DOWN;
 				slave->state =3D BOND_STATE_BACKUP;
@@ -2928,8 +3101,8 @@ static void bond_activebackup_arp_mon(st
=20
 			if ((slave !=3D bond->curr_active_slave) &&
 			    (!bond->current_arp_slave) &&
-			    (((jiffies - slave->dev->last_rx) >=3D
3*delta_in_ticks) &&
-			     my_ip)) {
+			    (((jiffies - slave->dev->last_rx) >=3D
3*delta_in_ticks)=20
+			     && bond_has_ip(bond))) {
 				/* a backup slave has gone down; three
times
 				 * the delta allows the current slave to
be
 				 * taken out before the backup slave.
@@ -2975,8 +3148,8 @@ static void bond_activebackup_arp_mon(st
 		 * if it is up and needs to take over as the
curr_active_slave
 		 */
 		if ((((jiffies - slave->dev->trans_start) >=3D
(2*delta_in_ticks)) ||
-		     (((jiffies - slave->dev->last_rx) >=3D
(2*delta_in_ticks)) &&
-		      my_ip)) &&
+	    (((jiffies - slave->dev->last_rx) >=3D (2*delta_in_ticks))
+		      && bond_has_ip(bond))) &&
 		    ((jiffies - slave->jiffies) >=3D 2*delta_in_ticks)) {
=20
 			slave->link  =3D BOND_LINK_DOWN;
@@ -3028,7 +3201,7 @@ static void bond_activebackup_arp_mon(st
 		/* the current slave must tx an arp to ensure backup
slaves
 		 * rx traffic
 		 */
-		if (slave && my_ip) {
+		if (slave && bond_has_ip(bond)) {
 			bond_arp_send_all(bond, slave);
 		}
 	}
@@ -3046,7 +3219,7 @@ static void bond_activebackup_arp_mon(st
=20
bond_set_slave_inactive_flags(bond->current_arp_slave);
=20
 			/* search for next candidate */
-			bond_for_each_slave_from(bond, slave, i,
bond->current_arp_slave) {
+			bond_for_each_slave_from(bond, slave, i,
bond->current_arp_slave->next) {
 				if (IS_UP(slave->dev)) {
 					slave->link =3D BOND_LINK_BACK;
=20
bond_set_slave_active_flags(slave);
@@ -3478,10 +3651,83 @@ static int bond_netdev_event(struct noti
 	return NOTIFY_DONE;
 }
=20
+/*
+ * bond_inetaddr_event: handle inetaddr notifier chain events.
+ *
+ * We keep track of device IPs primarily to use as source addresses in
+ * ARP monitor probes (rather than spewing out broadcasts all the
time).
+ *
+ * We track one IP for the main device (if it has one), plus one per
VLAN.
+ */
+static int bond_inetaddr_event(struct notifier_block *this, unsigned
long event, void *ptr)
+{
+	struct in_ifaddr *ifa =3D ptr;
+	struct net_device *vlan_dev, *event_dev =3D ifa->ifa_dev->dev;
+	struct bonding *bond, *bond_next;
+	struct vlan_entry *vlan, *vlan_next;
+
+	dprintk("bond_inetaddr_event this %p event %ld ptr %p\n",
+		this, event, ptr);
+	dprintk("event_dev %p %s ifa_local %x\n", event_dev,
+		event_dev ? event_dev->name : "NULL", ifa->ifa_local);
+
+	ASSERT_RTNL();
+
+	list_for_each_entry_safe(bond, bond_next, &bond_dev_list,
bond_list) {
+		dprintk("check bond %p %s\n", bond, bond->dev->name);
+		if (bond->dev =3D=3D event_dev) {
+			switch (event) {
+			case NETDEV_UP:
+				bond->master_ip =3D ifa->ifa_local;
+				dprintk("UP dev %s my_ip %x\n",
+				       bond->dev->name,
bond->master_ip);
+				return NOTIFY_OK;
+			case NETDEV_DOWN:
+				bond->master_ip =3D
bond_glean_dev_ip(bond->dev);
+				dprintk("DOWN dev %s my_ip %x\n",
+				       bond->dev->name,
bond->master_ip);
+				return NOTIFY_OK;
+			default:
+				return NOTIFY_DONE;
+			}
+		}
+
+		if (list_empty(&bond->vlan_list))
+			continue;
+
+		list_for_each_entry_safe(vlan, vlan_next,
&bond->vlan_list,
+					 vlan_list) {
+			dprintk("check vlan %p ID %d\n", vlan, vlan ?
vlan->vlan_id: 0);
+			vlan_dev =3D
bond->vlgrp->vlan_devices[vlan->vlan_id];
+			dprintk("check vlan id %d dev %p event_dev
%p\n",
+			       vlan->vlan_id, vlan_dev, event_dev);
+			if (vlan_dev =3D=3D event_dev) {
+				switch (event) {
+				case NETDEV_UP:
+					vlan->vlan_ip =3D ifa->ifa_local;
+					dprintk("UP vlan_ip %x\n",
vlan->vlan_ip);
+					return NOTIFY_OK;
+				case NETDEV_DOWN:
+					vlan->vlan_ip =3D
bond_glean_dev_ip(vlan_dev);
+					dprintk("DOWN vlan_ip %x\n",
vlan->vlan_ip);
+					return NOTIFY_OK;
+				default:
+					return NOTIFY_DONE;
+				}
+			}
+		}
+	}
+	return NOTIFY_DONE;
+}
+
 static struct notifier_block bond_netdev_notifier =3D {
 	.notifier_call =3D bond_netdev_event,
 };
=20
+static struct notifier_block bond_inetaddr_notifier =3D {
+	.notifier_call =3D bond_inetaddr_event,
+};
+
 /*-------------------------- Packet type handling
---------------------------*/
=20
 /* register to receive lacpdus on a bond */
@@ -4075,17 +4321,6 @@ static int bond_xmit_activebackup(struct
 	struct bonding *bond =3D bond_dev->priv;
 	int res =3D 1;
=20
-	/* if we are sending arp packets, try to at least
-	   identify our own ip address */
-	if (bond->params.arp_interval && !my_ip &&
-		(skb->protocol =3D=3D __constant_htons(ETH_P_ARP))) {
-		char *the_ip =3D (char *)skb->data +
-				sizeof(struct ethhdr) +
-				sizeof(struct arphdr) +
-				ETH_ALEN;
-		memcpy(&my_ip, the_ip, 4);
-	}
-
 	read_lock(&bond->lock);
 	read_lock(&bond->curr_slave_lock);
=20
@@ -4690,6 +4925,7 @@ static int __init bonding_init(void)
=20
 	rtnl_unlock();
 	register_netdevice_notifier(&bond_netdev_notifier);
+	register_inetaddr_notifier(&bond_inetaddr_notifier);
=20
 	return 0;
=20
@@ -4705,6 +4941,7 @@ out_err:
 static void __exit bonding_exit(void)
 {
 	unregister_netdevice_notifier(&bond_netdev_notifier);
+	unregister_inetaddr_notifier(&bond_inetaddr_notifier);
=20
 	rtnl_lock();
 	bond_free_all();
diff -Naur -p linux-2.4.31-rc1/drivers/net/bonding/bonding.h
linux-2.4.31-rc1-patched/drivers/net/bonding/bonding.h
--- linux-2.4.31-rc1/drivers/net/bonding/bonding.h	2004-04-14
15:05:30.000000000 +0200
+++ linux-2.4.31-rc1-patched/drivers/net/bonding/bonding.h
2005-05-26 16:15:23.000000000 +0200
@@ -36,8 +36,8 @@
 #include "bond_3ad.h"
 #include "bond_alb.h"
=20
-#define DRV_VERSION	"2.6.0"
-#define DRV_RELDATE	"January 14, 2004"
+#define DRV_VERSION	"2.6.2"
+#define DRV_RELDATE	"May 16, 2005"
 #define DRV_NAME	"bonding"
 #define DRV_DESCRIPTION	"Ethernet Channel Bonding Driver"
=20
@@ -149,6 +149,7 @@ struct bond_params {
=20
 struct vlan_entry {
 	struct list_head vlan_list;
+	u32 vlan_ip;
 	unsigned short vlan_id;
 };
=20
@@ -197,6 +198,7 @@ struct bonding {
 #endif /* CONFIG_PROC_FS */
 	struct   list_head bond_list;
 	struct   dev_mc_list *mc_list;
+	u32      master_ip;
 	u16      flags;
 	struct   ad_bond_info ad_info;
 	struct   alb_bond_info alb_info;

Best regards,
Peter Olsson
Visionutveckling AB

Re: [Devil-linux-develop] Building 1.2.5 from CVS

[Heiko Z. <he...@zu...>]

> Hi,
>
>
> When attempting to build 1.2.5 (branch 1-2-5) from CVS I got the
> following errors while doing a update_src.
>
> *************************************
> verifying md5 checksums md5sum: src/automake-1.9.tar.bz2: No such file or
> directory src/automake-1.9.tar.bz2: FAILED open or read
> md5sum: src/binutils-2.14.90.0.8.tar.bz2: No such file or directory
> src/binutils-2.14.90.0.8.tar.bz2: FAILED open or read
> md5sum: src/clamav-0.84.tar.gz: No such file or directory
> src/clamav-0.84.tar.gz: FAILED open or read
> md5sum: src/eagle-usb-1.9.8.tar.bz2: No such file or directory
> src/eagle-usb-1.9.8.tar.bz2: FAILED open or read
> md5sum: src/libtool-1.5.8.tar.gz: No such file or directory
> src/libtool-1.5.8.tar.gz: FAILED open or read
> md5sum: src/libxml2-2.6.15.tar.gz: No such file or directory
> md5sum: src/libxslt-1.1.12.tar.gzsrc/libxml2-2.6.15.tar.gz: FAILED open or
>  read : No such file or directory
> src/libxslt-1.1.12.tar.gz: FAILED open or read
> md5sum: src/reiserfsprogs-3.6.11.tar.gz: No such file or directory
> src/reiserfsprogs-3.6.11.tar.gz: FAILED open or read
> md5sum: WARNING: 8 of 406 listed files could not be read
>
>
> ************************************************************
>
>
> Should I be concerned about these?

Yes, because this means the CVS and FTP sources you got are out of sync.

> Should I have started with a get from 1-2-patches ?

Yes always use 'rel-1-2-patches' as the branch name.

-- 

Regards
  Heiko Zuerker
  http://www.devil-linux.org

[Devil-linux-develop] Building 1.2.5 from CVS

[<js...@bi...>]

Hi, 

When attempting to build 1.2.5 (branch 1-2-5) from CVS I got the following 
errors while doing a update_src. 

*************************************
verifying md5 checksums
md5sum: src/automake-1.9.tar.bz2: No such file or directory
src/automake-1.9.tar.bz2: FAILED open or read
md5sum: src/binutils-2.14.90.0.8.tar.bz2: No such file or directory
src/binutils-2.14.90.0.8.tar.bz2: FAILED open or read
md5sum: src/clamav-0.84.tar.gz: No such file or directory
src/clamav-0.84.tar.gz: FAILED open or read
md5sum: src/eagle-usb-1.9.8.tar.bz2: No such file or directory
src/eagle-usb-1.9.8.tar.bz2: FAILED open or read
md5sum: src/libtool-1.5.8.tar.gz: No such file or directory
src/libtool-1.5.8.tar.gz: FAILED open or read
md5sum: src/libxml2-2.6.15.tar.gz: No such file or directory
md5sum: src/libxslt-1.1.12.tar.gzsrc/libxml2-2.6.15.tar.gz: FAILED open or 
read
: No such file or directory
src/libxslt-1.1.12.tar.gz: FAILED open or read
md5sum: src/reiserfsprogs-3.6.11.tar.gz: No such file or directory
src/reiserfsprogs-3.6.11.tar.gz: FAILED open or read
md5sum: WARNING: 8 of 406 listed files could not be read 

************************************************************ 

Should I be concerned about these? 

Should I have started with a get from 1-2-patches ? 

thanks,
jon